Data filters for reports

Filters are the main tool for increasing the granularity of reports.

The Report Items define some general criteria for selecting data. For example, you can produce a report of connections by source IP address. Defining general criteria is a good way to get an overview, but in many cases, you want more specific information.

For example, a general item such as the total number of logged connections can be made much more specific. To make this item more specific, apply a filter that matches a single pair of source and destination IP addresses. The filter only counts connections between these two hosts.

Only log-based raw data is suitable for log filters. Counter Statistics Data items use pre-counted statistical data instead of logs, so most log data filters cannot be used with Counter Statistics Report Items. You can only filter Counter Statistics Report Items by sender (the component that generated the statistics).

You can define a filter at one or more of the following levels:
  1. Report Task — Applies to the single report produced by a particular task or to all reports produced by a task that is scheduled to run regularly.
  2. Report Design — Applies to all reports produced using the Report Design.
  3. Report Section — Applies to all items included in the section.
  4. Report Item — Applies to that specific item only.

If filters are applied at several of these levels, all filters are applied and the log entries are filtered top-down in the order listed. Each filtering stage completely excludes non-matching log entries for the stage in which the filter is applied and all further stages. For example, select the filter, TCP destination port 80, for a Report Section. Then, all items in that section only process information in log entries that mention TCP destination port 80.